Security researchers at Trend Micro's Trend Labs have uncovered a trick in a sample of a fake news application for Android created by the network exploitation tool provider Hacking Team that may have allowed the company's customers to sneak spyware through the Google Play store's code review. While the application in question may have only been downloaded fewer than 50 times from Google Play, the technique may have been used in other Android apps developed for Hacking Team customers—and may now be copied by others trying to get malware onto Android devices.

The sample app, called "BeNews," is designed as a Trojan horse for Hacking Team's RCSAndroid "backdoor" malware. It used the name of a defunct news site to make it seem like a legitimate Android application. Wish Wu of Trend Labs wrote in a blog post that Trend Labs team found the source code for the app within the leaked Hacking Team files, along with documentation "that teaches customers how to use it," he wrote. "Based on these, we believe that the Hacking Team provided the app to customers to be used as a lure to download RCSAndroid malware on a target's Android device."

The app exploits a local privilege escalation vulnerability in Android which has been determined to affect all versions of the mobile operating system from Android 2.2 ("Froyo") to 4.4.4 ("KitKat"). Other versions may be vulnerable as well, according to Wish. The exploit, which also affected other Linux operating systems, was documented last summer.

But the exploit appeared not to be included in the initial code of the BeNews app. "Initially, it only asks for three permissions and can be deemed safe by Google’s security standards as there are no exploit codes to be found in the app," Wish noted. But after the application is downloaded and run by the user, it can dynamically load additional code—including the exploit, which is then used to escalate permissions and install the RCSAndroid backdoor.

It's not clear how large a threat the Hacking Team version of this exploit posed—it required the targeted phone to install the application, which would have required physical access to the phone or social engineering of its user. But the code and documentation for the app is now out in the open and is likely being used to sneak other malicious apps past Google's code review into the Google Play store.

Share this story

Sean Gallagher
Sean is Ars Technica's IT and National Security Editor. A former Navy officer, systems administrator, and network systems integrator with 20 years of IT journalism experience, he lives and works in Baltimore, Maryland. Emailsean.gallagher@arstechnica.com//Twitter@thepacketrat